Secret keys embedded in devices such as integrated circuits (chips) can be used to authenticate the devices. An example of such an approach uses a secret key embedded in a smart card. This secret key is not intended to be read out, but can be used to decrypt messages sent to the smart card. A service provider who knows the secret key can authenticate the smart card by asking it to decrypt an encrypted message or using other cryptographic protocols that verify that the smart card possesses the key. The secret key needs to remain secret so that an adversary cannot duplicate the key and assume a false identity.
For many applications, a secret key embedded in a chip does not have to be unique. The same key can be embedded into many chips when one merely wants to authenticate that a chip belongs to a particular set, and does not need to uniquely identify a particular chip or device or merely needs to decode content that has been broadcast in an identical format to a group of devices. One current practice has integrated circuits storing non-volatile keys in various types of Read-Only Memory (ROM) such as Programmable ROM, Electrically Programmable ROM, and Electrically Erasable Programmable ROM. In this case, each integrated circuit is programmed during or after manufacture to place the appropriate key in ROM.
An adversary may probe such a chip to attempt to find the secret key using invasive methods, such as removal of the package and layers of the integrated circuit, or non-invasive methods, such as differential power analysis that attempts to determine the key by stimulating the integrated circuit chip and observing the power and ground rails. To prevent physical invasion of the chip to determine non-volatile keys, powered sensing circuitry may be included in the packaging of the chip to detect intrusion and erase sensitive information upon detection of intrusion.
By designing a special-purpose or general-purpose processor with a secret non-volatile key embedded in it, it is possible to design software or media content that is specific to a processor chip or a set of processor chips that contain a particular key. For example, the software or media content cannot be run or played on other processor chips that do not contain the particular key. Requiring that instructions in the software or data items in the media file need to be decrypted by a particular key or periodically decrypted, possibly on an established schedule or protocol enables Digital Rights Management (DRM) applications.
Authentication of integrated circuits has been suggested using device characteristics that vary from device to device based on variation in the fabrication process. Some such approaches, which are bases on circuit delay are described in U.S. Application Publication US2003/0204743A1, titled “Authentication of Integrated Circuits,” which is incorporated herein by reference. Threshold voltage variations in circuits fabricated on different integrated circuits have also been used to generate unique identifiers for individual chips, as described in U.S. Pat. No. 6,161,213, to Keith Lofstrom, titled “System for Providing an Integrated Circuit with a Unique Identification.” However, Lofstrom's identifiers have limitations for use as secret keys in cryptographic applications because they may be exposed externally to the device and not be generated in a reliable enough fashion for use in cryptographic applications.